Can a hacker compromise the system if he can steal one of the factors of the 2FA?

Question

I read this article saying that smartcards used as a 2FA are still susceptible to attacks such as MITM attack:

They think 2FA is unhackable...undefeatable, when that clearly isn’t true. They think 2FA will stop advanced persistent threats (APTs), defeat phishing and social engineering, and stop all sorts of threats that it was never designed to do.

Does it mean it is not safe to use smartcards in terms of 2FA? Also for example I have a device or website that I want to log in using a password with 2FA. Is there any chance that a hacker can still compromise the system if he can get the password or the smartcard?

Answer 1

I read an article saying that smartcards used as a 2FA is still susceptible to attacks such as MITM attack?

I interpret the relevant parts of this article as follows:

1. A hacker could mirror the original web site which asks for password and 2FA token and just forward the credentials you've entered to the original site, then doing whatever he wants with the now logged in session.
2. A 2FA authentication might be done only against the local system and then the result (in form of some authentication token) is used to authenticate against a remote system, then this token could be stolen.

To address the first issue: This is true if the 2FA is only some kind of token which you enter. If instead the smartcard has a client certificate which is used for mutual authentication within a TLS connection, then this can neither be stolen when connecting to a fake website nor can the authentication be forwarded to the original site since the attacker does not have access to the private key stored on the smartcard.

And for the second issue: If the full authentication is only done to the local machine and then the local machine provides some authentication against the remote machine then this remote machine can of course not check if 2FA is valid and must simply trust the local machine. Thus the question is not only how to do you authenticate but also against whom you authenticate: a local machine or a remote system. Of course, since no 2FA information are send to the remote system in the first place there is no MITM of 2FA done. And yes, a hacker could intercept the authentication token unless the transfer of the token is protected against MITM, for example within a TLS connection with mutual authentication between the machines.

In other words: smartcards are by themselves are not affected by MITM. But they might be used in a way which makes MITM still possible or which makes it ignore the second faktor. But using smartcards for mutual authentication within a TLS connection is considered safe even if the web site you connect to was not the correct one.

Answer 2

Smartcards are the safest of the common options as far as I know. And if only password or only smardcard is compromised by hacker, the system is safe. Both are needed to authenticate.

What this article is trying to point out is that 2FA as a concept only stops some kind of attacks, but does not prevent all kind of attacks. Furthermore, 2FA has to still be implemented, which leaves the same problems as any other security software. The implementation may be badly designed or have bugs, that have nothing to do with the 2FA itself. It is like RSA being secure but openssl being vulnerable to heart-bleed. RSA is secure but just because you are using it does not mean there is not another problem.

Here is a quick and likely incomplete list of examples what 2FA does not protect you from:

• MITM - An attacker listening in on the line and intercepting your connection. SSL should be used to prevent this, 2FA does not do it.
• Fake website - an attacker making a same looking site and tricking the user to log in to it, then forwarding the credentials (both smartcard and password) to the real site. The attacker can only attack at this time while with password, he could save it for later.
• Compromise of the server - 2FA does not help at all if your underlying server gets compromised, for example with a bug like hartbleed as was mentioned.
• Physical attack - 2FA does next to nothing to stop an attacker with physical access to the machine.
• Attack on recovery method - Such as reset passwod/smartcard by mail. If there is such a recovery option, it can be often abused. This goes both for automated ones and manual ones done by human (social engineering).
• Social engineering on an admin - An attacker may try to convince an admin that they lost their smartcard and they need it reset or disabled to log in.

In conclusion, 2FA is useful but it has to be used in conjunction with other security measures. It is not a single solution for all your problems. I strongly recommend getting a professional to design your security strategy.

Note that some of these might be prevented by advanced designs of 2FA but are not by common ones.